The collection paths
- Ctrl+Alt+Shift+1 (desktop client): dumps diagnostic logs to Downloads — the one shortcut every service desk should know. Contains the app logs; media-specific logs ride along.
- Settings > Help/diagnostics: user-friendly collection; mobile clients collect from their settings too.
- TAC remote log collection: admin-triggered pull from a user's client
(device permitting) — no user choreography (
TeamsRemoteLogCollectionsurface exists in your scanned config).
Everything is timestamped UTC — sync the user's 'it broke about 2:15-ish' to UTC before grepping, or drown.
Markers that pay rent (grep these)
| Looking for | Marker family |
|---|---|
| Sign-in loops | Token acquisition/refresh failures, CAE claims challenges — correlate with Entra sign-in log same-minute |
| Call setup death | Call id creation then ICE gathering results — zero relay candidates = 3478 blocked from THIS network |
| Mid-call gap | ICE restart / network-change events at the reported time |
| Device chaos | Capture/render device enumeration — the empty or flapping device list |
| The wrong network | Interface selection lines: VPN adapter chosen over Wi-Fi explains everything about that call |
The strategy is never read-it-all: form the hypothesis from Call Analytics FIRST, then grep the client log for the five minutes around the event to confirm mechanism.
When NOT to be here
Client logs are the LAST mile. Service-side truth (Call Analytics/CQD), policy truth (the scan), and network truth (a capture) each answer most questions faster. Descend to client logs when: telemetry healthy + user credible; reproduction is impossible; or the failure is pre-service (client never reached signalling — nothing server-side to read).
What to watch (proofs)
- The correlation triangle for any incident: client log event (UTC) <-> Call Analytics leg <-> Entra sign-in row — three timestamps agreeing is a diagnosis; two disagreeing is the finding.
- ICE candidate zero-counts: the client log's gathering summary from the affected network — the portable proof that a site blocks 3478 (attach it to the network team's ticket; it ends the 'our firewall is fine' phase).
- Remote collection coverage: policy state for log collection in your scan — that it works BEFORE the incident, tested on a friendly user.
- A wiki of YOUR tenant's greatest hits: each closed deep-dive contributes its marker + meaning — institutional grep memory. (The community thread under this very concept is a fine place for it.)